Smallhttp

Overview

HackTool:Win32/Smallhttp refers to highly compact, portable web server executables that are frequently dropped onto compromised machines by attackers during post-exploitation. While web servers are legitimate software, attackers use 'Smallhttp' utilities because they require no installation, leave minimal footprint, and can be instantly bound to a port to facilitate rapid data exfiltration (`T1041`) or internal payload staging for lateral movement.

Understanding Smallhttp (Staging and Exfiltration)
To an end-user, there is no visible impact. For a SOC analyst, the presence of an unexpected HTTP server running on an endpoint (especially a workstation) is a massive red flag. It indicates the attacker has bypassed initial defenses and is now establishing an internal staging area to move deeper into the network or preparing to steal large volumes of data.

Execution and Exploitation Mechanics
After gaining a shell on a machine (e.g., via a spearphishing macro or RDP brute force), the attacker drops a tiny HTTP server executable (often only a few kilobytes in size) into a hidden directory. They execute it via the command line, pointing it to a directory containing stolen data (like ZIP files of documents) (`T1560`). The attacker can then simply use `curl` or `wget` from another compromised machine (or externally, if the firewall allows) to download the stolen data over standard port 80/8080, masking the exfiltration as normal web traffic (`T1071.001`).

Indicators of Compromise & Impact
The impact is usually significant data loss or the facilitation of lateral movement. Host-based IoCs include EDR alerts for unknown executables binding to network ports (listening state) on workstations. Look for processes like `svchost.exe` or `cmd.exe` spawning an unknown binary with command-line arguments specifying a port and directory path. Network IoCs include a sudden spike in outbound HTTP GET requests originating *from* the compromised workstation to external IPs, or unusual internal HTTP traffic between workstations.

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to our technical analysis hubs and the official MITRE ATT&CK framework:

Tactical Mitigations

Based on the techniques used by this family, consider the following defensive strategies:

• T1071.001: Implement web filtering and SSL/TLS inspection to detect malicious command and control (C2) traffic hiding in HTTP/HTTPS.
• T1105: Implement network intrusion detection systems (NIDS) and host-based firewalls to block unauthorized inbound or outbound file transfers.

MITRE D3FEND™ Defensive Countermeasures

Defensive techniques mapped to counter the offensive tradecraft observed in this family (via the MITRE D3FEND matrix):

Tiered Detection Rules (Cisco CAIRN Model)

Modern threat detection requires multi-layered rule engineering. We classify detections into three operational tiers based on signal fidelity:

rule MALWARE_WIN_SMALLHTTP_T1_ARTIFACT {
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Smallhttp"
        tier = "T1 - Primitive Artifact"
        confidence = "Low-Medium (Fast Triage)"
        author = "SystemHelpdesk Threat Research Desk"
        date = "2026-10-14"
    strings:
        $s1 = "smallhttp" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

title: SystemHelpDesk Detection - Smallhttp (Advanced Threat) Execution & Triage
id: d040aa36-f233-5c01-bfed-b2a68bc25036
status: production
description: Detects execution, defense evasion, and persistence behaviors associated
  with the Smallhttp malware family. Detects proxy execution, reflective DLL loading,
  and remote command injection associated with modular enterprise backdoors.
references:
- https://malware-families-catalog.systemhelpdesk.com/families/smallhttp
- https://malware-families-catalog.systemhelpdesk.com/defensive/backdoor-rat-protection
- https://malware-families-catalog.systemhelpdesk.com/
author: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP
date: '2026-10-14'
modified: '2026-10-14'
tags:
- attack.advanced-threat
- author.ricky-jordan
- source.systemhelpdesk-mfc
- attack.t1071_001
- attack.t1105
- attack.t1041
logsource:
  category: process_creation
  product: windows
detection:
  selection_process:
    Image|endswith:
    - \powershell.exe
    - \cmd.exe
    - \rundll32.exe
    - \regsvr32.exe
    CommandLine|contains:
    - DownloadString
    - IEX(
    - '/s /n /u /i:'
    - sc create
    - start-process
  condition: selection_process
falsepositives:
- Legitimate enterprise administrative scripts during approved change windows
- Authorized IT software deployment utilities and backup management agents
level: high

rule MALWARE_WIN_SMALLHTTP_T3_ATTRIBUTION {
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Smallhttp tradecraft"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpdesk Threat Research Desk"
        date = "2026-10-14"
    strings:
        // Core family identifier & heuristic payload signatures
        $attrib_str = "smallhttp" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker = "http" ascii nocase
    condition:
        uint16(0) == 0x5a4d and ($attrib_str and $net_marker) and filesize < 15MB
}

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Isolate the endpoint immediately; if the server is running, the attacker is actively moving data.
2. Use `netstat -ano` or EDR tools to identify the specific process bound to the HTTP port and terminate it.
3. Identify the directory the Smallhttp server was serving to determine exactly what data the attacker was exfiltrating.
4. Review internal network flows to see if other endpoints downloaded payloads *from* this staging server.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not simply kill the process and move on; you must investigate what files were in the web root to understand the scope of the breach.
2. Avoid relying solely on external firewall logs; if the attacker used the server for internal lateral movement, the traffic never left the network.

References & External Analysis

• Search "smallhttp" on VirusTotal (External Analysis)
• Search "smallhttp" on Any.Run (Sandbox Sandbox)
• Search "smallhttp" on MalwareBazaar (Malware Samples)

Frequently Asked Questions

Related Threats (Category: Advanced Threat)

Explore other documented threats in the same operational category:

• Refogkeylogging
• Pikachu
• Scramupx
• Offergenerator
• Inno
• Zugo
• Pwdump
• Mediamagnet

Machine-readable

Get this profile as JSON: https://malware-families-catalog.systemhelpdesk.com/api/smallhttp.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.